PaperlayerView exact revision on arXiv

Source-linked AI summary

Information Fusion for Anomaly Detection with the Dendritic Cell Algorithm

Julie Greensmith, Uwe Aickelin, Gianni Tedesco

arXiv:1003.0789v1cs.AIcs.CRcs.NE

TL;DR

Signature-based detection can miss modified or new intrusions, motivating anomaly detection approaches for threats such as port scans. The paper presents an immune-inspired algorithm that fuses signals and correlates them with antigen data, and reports successful ping-scan detection under sensible parameter values.

  • Problem

    Signature-based intrusion detection can miss modified or new intrusions that are absent from its database.

    Source: §1 · p. 2

  • Method

    The Dendritic Cell Algorithm models dendritic-cell signal fusion and correlates fused environmental signals with a separate antigen data stream.

    Source: §1 · p. 1, §8 · p. 20

  • Results

    The DCA detects ping-based port scans when its parameters are within a sensible range, and detection of anomalous processes is robust to changes in signal-processing weights.

    Source: §8 · pp. 19–20

  • Takeaways & Limitations

    The DCA’s signal-fusion and antigen-correlation approach works for port-scan detection, but suitable safe-signal selection matters for performance.

    Source: §8 · pp. 19–20

    The DCA’s general applicability remains unexplored, and its input data make comparisons with standard machine-learning or signature-based systems difficult.

    Source: §8 · p. 20

Abstract

from arXiv · show

Dendritic cells are antigen presenting cells that provide a vital link between the innate and adaptive immune system, providing the initial detection of pathogenic invaders. Research into this family of cells has revealed that they perform information fusion which directs immune responses. We have derived a Dendritic Cell Algorithm based on the functionality of these cells, by modelling the biological signals and differentiation pathways to build a control mechanism for an artificial immune system. We present algorithmic details in addition to experimental results, when the algorithm was applied to anomaly detection for the detection of port scans. The results show the Dendritic Cell Algorithm is sucessful at detecting port scans.

1. Introduction

The paper introduces the Dendritic Cell Algorithm (DCA), an immune-inspired information-fusion approach to anomaly detection, and applies it to port-scan detection. It situates this application among the limits of signature-based and event-threshold detection methods.

1. Introduction

  • The DCA correlates environmental signals with antigen data to detect anomalies, drawing on dendritic cells’ multisensor information fusion.The paper notes that fine-grained weight analysis and comparison with standard techniques are deferred because the algorithm is not yet fully characterized.Source: §1 · pp. 1–2
  • The DCA successfully detects anomalous processes forming a port-scan attack.The paper presents the algorithm as an artificial immune-system approach inspired by the human immune system.Source: §1 · p. 1
  • Signature-based intrusion detection can miss modified or previously unseen intrusions absent from its database, while anomaly detection must contend with changing definitions of normal behavior.A changing normal profile can lead to false positives.Source: §1 · p. 2

2.1. General Principles of Port Scanning

  • Port scans map network endpoints and can help attackers identify vulnerable hosts; their footprints vary with the selected addresses and ports.The paper discusses host, port, and service probes, and horizontal, vertical, and block scan footprints.Source: §2.1 · p. 2, §2 · p. 3

2.2. Port Scan Detection

  • Many port-scan detectors rely on event counts within a time window, an approach that can miss stealthy scans with too few events.A related scanning-worm approach detected all but the slowest scans; realistic, noisier test conditions were not reported for preliminary results.Source: §2.2 · p. 4
  • Extrusion detection examines outgoing traffic to identify hosts that may be scanning locally after infection, a potential route to detecting insider attacks.The cited work reports extrusion detection as effective for preventing spam across a medium-sized network.Source: §2.2 · p. 4

3. The Immune System: A DC’s Perspective

The section traces immune activation from signal-based theories to dendritic cells, whose signal-dependent maturation determines how collected antigens are presented. Immature cells can become mature or semi-mature, producing distinct immune contexts.

3. The Immune System: A DC’s Perspective

  • The immune system’s response is described through innate and adaptive defenses, with danger theory emphasizing tissue signals over antigen structure.The text also notes that self-nonself and infectious-nonself accounts did not explain some immune responses, including autoimmunity.Source: §3 · pp. 5–6

3.1. Introducing Dendritic Cells

  • Dendritic cells collect tissue debris and sense PAMP, danger, and safe signals; their relative concentration determines differentiation state.Immature dendritic cells collect antigen but cannot directly activate T-cells.Source: §3.1 · p. 6, §3.2 · p. 6

3.2. Immature DCs (iDC)

  • Immature dendritic cells collect antigen and detect tissue signals, which alter their function and determine their terminal state.The resulting cytokines can activate or suppress immune responses.Source: §3.2 · p. 6

3.3. Mature DCs (mDC)

  • Greater exposure to PAMPs or danger signals than safe signals drives immature dendritic cells to mature, stop collecting antigen, and migrate to lymph nodes.Mature cells present antigen and produce Interleukin-12 and costimulatory molecules that support T-cell activation.Source: §3.3 · pp. 6–7

3.4. Semi-mature DCs (smDC)

  • Safe signals under apoptotic conditions divert immature dendritic cells to a semi-mature state that presents antigen without activating T-cells.Semi-mature cells produce Interleukin-10, which suppresses matching T-cells; safe signals can inhibit Interleukin-12 and increase Interleukin-10 production.Source: §3.4 · p. 7

3.5. Summary

  • Dendritic cells fuse PAMP, danger, and apoptotic signals to produce distinct outputs that guide immune responses to collected antigen.Danger-associated signals support mature presentation, while apoptotic signals produce a semi-mature, tolerogenic context.Source: §3.5 · p. 7

4. From in vivo to in silico

The abstraction retains the dendritic cell features the authors consider essential: signal-dependent differentiation, antigen sampling and presentation, and population-level outcomes. It represents signals and antigen as inputs that jointly shape cell outputs.

4. From in vivo to in silico

  • The abstraction models dendritic cells through differentiation states, signal interactions, and antigen, retaining features the authors consider essential to their biology.The authors describe this abstraction as developed in collaboration with immunologists.Source: §4 · p. 7
  • The combined behavior of a dendritic-cell population determines the overall decision between tolerance and activation.The modeled inputs include PAMP, danger, and safe signals.Source: §4 · p. 8
  • An immature cell’s differentiation depends on its signal complement, while safe signals suppress mature output and semi-mature cells signal a normal collection context.Immature cells can sample multiple antigens and re-present them with cytokines reflecting context.Source: §4 · p. 8
  • Both mature and semi-mature cells present antigen with costimulatory molecules, but their outputs respectively indicate danger and damage or normal context.Exposure to signals initiates maturation, while output quantity reflects the relative strength of input signals.Source: §4 · pp. 7–8

5. The Dendritic Cell Algorithm

The DCA is implemented as a population of software-based dendritic-cell agents that fuse data from different sources. Libtissue separates input processing from server-side algorithm execution and supports event-driven updates and antigen-context analysis.

5. The Dendritic Cell Algorithm

  • The DCA uses software-based artificial dendritic cells to combine data from disparate sources within an implemented libtissue system.Libtissue provides a client/server architecture, separating data collection by clients from processing on a server.Source: §5 · p. 8, Figure 3 · p. 8

5.1. Libtissue

  • Libtissue clients transform raw inputs into antigen and signals, which interact with cells in a tissue compartment holding signal levels and an antigen store.The architecture permits signal and antigen sources to be added for testing with different data sources.Source: §5 · p. 8
  • Event-driven tissue updates refresh signals and antigen; multiple dendritic cells sample antigen with context, and aggregation uses MCAV to assess anomaly.MCAV is the fraction of presentations in which mature output exceeds semi-mature output; values closer to 1 indicate greater probability of anomaly if the DCA functions as intended.Source: §5.2 · p. 9

S2 Signal Matrix behavioural signals S3

The algorithm repeatedly updates tissue and cell data, fuses signal inputs into cell outputs, and aggregates antigen presentations into a context-based anomaly measure. Signal categories encode normal, danger, and pathogen-associated behavior.

S2 Signal Matrix behavioural signals S3

  • Each update cycle refreshes dendritic-cell inputs and accumulates costimulatory, mature, and semi-mature outputs until cells migrate or processing stops.The algorithm then aggregates antigen presentations into MCAV, the fraction of presentations with mature output greater than semi-mature output.Source: S2 Signal Matrix behavioural signals S3 · p. 9, §5.3 · p. 10, §5.5 · p. 11

5.3. Parameters and Structures

  • Each cell stores signal inputs, antigen, cumulative outputs, and a migration threshold; weighted transformations map signal values to outputs.The signal-processing weights are described as derived from experiments on natural dendritic cells.Source: §5.3 · p. 10, Table 1 · p. 10

5.5. Antigen Aggregation

  • Migrated cells are recycled after their antigen and output values are logged, allowing repeated antigen presentations to contribute different context values.Each cell samples R antigens from the tissue antigen vector per cell update.Source: §5.5 · p. 11

5.4. The DCA

  • The DCA initializes parameters, repeatedly updates tissue and cells, samples antigen, computes outputs, and migrates cells when cumulative costimulatory output exceeds threshold.The cycle continues until its stopping condition is met, usually after all antigen has been processed.Source: §5.4 · p. 11

5.6. Signals and Antigen

  • PAMP signals indicate abnormal signatures, danger signals rise with abnormal behavior, and safe signals reflect predictable or steady behavior.Antigen is the data to be classified; detection correlates it with fused signals, without altering the sampled antigen value.Source: §5.6 · pp. 11–12

6. PSI: Ping Scan Investigation

The investigation applies the DCA to an outgoing ICMP ping scan and examines signal mappings and parameter and weight sensitivity. It uses attack and normal sessions, with signals derived from kernel statistics.

6.1. Data Sessions

  • Each attack session embeds a ping scan in a 70-second SSH session, while normal sessions include SSH login and SCP file transfer; ten datasets are generated for each type.The scan covers 1,020 IP addresses, and four processes of interest are identified in each session type.Source: §6.1 · p. 12

6.2. Signals

  • The experiments use three signal categories, collected from kernel statistics and normalized before combination with antigen.PAMP and danger values range from 0–100, while safe values range from 0–10.Source: §6.2 · p. 12
  • Analysis of the signals individually is insufficient to indicate anomalies.The passage notes this is further highlighted in the DCLite experiment.Source: §6.2 · p. 13
  • The PAMP signal uses the rate of ICMP destination-unreachable errors, while the danger signal uses sent network packets per second.A rise in sent traffic can indicate anomalous behavior, though it is less useful in some circumstances such as file uploads.Source: §6.2 · p. 13
  • The safe signal uses the rate of change in packets per second to counter danger-signal increases under normal conditions and may reduce false positives.The signal design assumes anomalous traffic is bursty, whereas large file uploads have less variable rates of change.Source: §6.2 · p. 13

6.3. Antigen

The DCA correlates signals with process-linked antigen to identify anomalous processes. The experiments examine signal mappings and the sensitivity of algorithm parameters and signal-processing weights.

6.3. Antigen

  • System calls from monitored processes are captured as antigen and tagged with the process PID, allowing signal correlations to identify culprit processes.The experiments aim to detect the nmap process and its sshd parent while preventing a response to normal scp file transfer.Source: §6.3 · p. 13

6.4. Experiments

  • The experiments examine whether signal mappings, libtissue parameters, and signal-processing weights affect system behavior and detection.The series are organized around mapping validity, parameter sensitivity, and the effect of varying signal-processing weights.Source: §6.4 · p. 13

6.5. Series-1

  • Series-1 tests signal-category mappings across all 20 attack and normal datasets, with three runs per dataset, and predicts poor performance when danger and safe signals are reversed.The authors hypothesize that swapping PAMP and danger may preserve detection accuracy because those signals affect dendritic cells similarly.Source: §6.5 · p. 14

6.6. Series-2

The experiments investigate libtissue parameters and signal-processing weights to clarify their effects on DCA behavior.

6.6. Series-2

  • Series-2 investigates four libtissue parameters using ten attack datasets that include normal and anomalous data, with three repeats per dataset.The parameters are the number of DCs, DC antigen vector size, number of DC antigen receptors, and tissue antigen vector size.Source: §6.6 · p. 14
  • The signal-processing equation combines multiple input signals into three outputs, with the relationships among weights inspired by empirical biological data.The investigation varies weights W1 and W2.Source: §6.6 · p. 14
  • A 36-experiment sweep tests W1 and W2 at 0.5, 1, 2, 4, 8, and 16, using one randomly selected attack dataset and three runs per combination.The tested range is motivated by preliminary tests and prior experience when the maturation threshold is 60 (+/- 50%).Source: §6.6 · p. 14

6.8. Parameters and Settings

The reported mapping results show higher MCAVs for the two anomalous processes than for the normal processes. The section also describes the implementation and how true- and false-positive rates are calculated.

6.8. Parameters and Settings

  • The system classifies processes as normal or anomalous to calculate the relevant true- and false-positive rates.The same calculation is used throughout the section.Source: §6.8 · p. 15
  • MCAVs were 0.82 (stdev 0.11) for nmap and 0.67 (stdev 0.22) for pts, versus 0.02 (stdev 0.04) for bash and 0.18 (stdev 0.24) for sshd.The anomalous-process values are reported as statistically significantly higher than those for the normal processes, using paired t-tests with p = 0.05.Source: §6.8 · p. 15
  • The algorithm is implemented in C within the libtissue framework, with SCTP interprocess communication and signal values taken from the proc filesystem.Default experiment parameters are presented in Table 5, and Table 4 summarizes weight derivation and interrelationships.Source: §6.8 · pp. 14–15, Table 5 · p. 15, Table 4 · p. 15

6.9. Results

The experiments assess process anomaly scores using MCAV and show how signal mappings and DCA parameters affect port-scan detection. Detection is strongest with the intended mapping and remains stable across many tested parameter changes, though some mappings and settings raise scores for normal processes.

Signal mappings

  • With intended mapping M1, anomalous processes had significantly higher MCAVs than normal processes; swapping PAMP and danger signals in M2 preserved similar detection, with bash MCAV rising from 0.02 to 0.27.The comparison spans attack datasets; the authors note a slight increase in false positives under M2.Source: §6.9 · p. 15, Figure 8 · p. 15
  • M3 raised MCAVs for normal processes, M4 reduced anomalous-process scores, and M5 produced the highest anomalous-process scores but also elevated normal-process scores in attack datasets.M6 also reduced nmap MCAV to 0.61 (stdev=0.37); Table 6 reports MCAV values and standard deviations across experiments and datasets.Source: §6.9 · p. 16, Table 6 · p. 16
  • On normal datasets, M1 and M2 produced low MCAVs, whereas M3 produced MCAV 1 for all processes and M4 produced values above 0.5.M5 kept the normal-dataset scp MCAV at 0.13, not significantly different from M1; M6 resembled M3 but with lower MCAVs.Source: Figure 8 · p. 15, §6.9 · p. 16

Parameter sensitivity

  • For cell counts above 100, nmap MCAV remained high; at 10 cells it fell from 0.9 to 0.1, while normal-process MCAVs were higher than with other cell counts.No significant differences were found among 100, 200, and 500 cells for any process.Source: Figure 9 · p. 16, Figure 10 · p. 17
  • Varying the DC antigen-vector size produced no significant differences for any process of interest; performance was marginally impaired at size 100, but that impairment was not significant.Separately, tissue-vector sizes T50 and T500 yielded bash MCAVs of 0.28 and 0.08, respectively.Source: §6.9 · pp. 16–17
  • Changing receptor count produced no significant difference for anomalous-process detection, but bash MCAV was significantly higher at 20 receptors than at 2 (0.38 versus 0.22).Figure 12 presents MCAV by process for receptor-count settings.Source: §6.9 · p. 17, Figure 12 · p. 17

Weight sensitivity

  • Across tested weight settings, MCAVs for anomalous nmap and pts processes remained consistently above 0.8, indicating insensitive detection for those processes.Figures 14 and 15 show the weight-sensitivity surfaces for the represented processes.Source: §6.9 · p. 17, Figure 14 · p. 18, Figure 15 · p. 18
  • The sshd and bash weight-sensitivity surfaces showed greater MCAV variation; the reported plots also show small MCAVs for normal processes.Figures 16 and 17 show the sshd and bash surfaces.Source: §6.9 · pp. 17–18, Figure 16 · p. 18

7. Analysis

The analysis finds that signal meaning matters: the intended mapping distinguishes anomalous from normal processes, while several incorrect mappings impair that separation. Many tested parameter changes have little effect, but weight choices can alter MCAVs for normal processes.

Signal mappings

  • With M1, anomalous-process MCAVs were significantly larger than normal-process MCAVs; swapping PAMP and danger signals in M2 did not significantly change anomalous-process MCAVs.M2 generally had larger standard deviations, especially for nmap.Source: §7 · pp. 18–19
  • Mapping safe signals as PAMPs in M3 drove MCAVs to 1 for all normal-dataset processes, while mapping PAMPs as safe signals in M6 impaired performance through insufficient suppression.The authors attribute M3's indiscriminate maturation to the continuously generated safe signal.Source: §7 · p. 19
  • M5 raised MCAVs for normal processes in attack datasets but not normal datasets; the authors attribute this contrast to danger signals being counterbalanced by safe signals under normal scenarios.They also note that infrequent PAMP input was insufficient to cause full maturation.Source: §7 · p. 19

Parameter analysis

  • Series-2 parameters generally had little influence, with exceptions at very low cell, storage, and receptor values; biologically derived defaults often gave the most consistent results.The authors suggest the defaults may work together, accounting for some observed robustness.Source: §7 · p. 19

Weight analysis

  • In Series-3, anomalous-process MCAVs were insensitive to weight changes, but some settings increased normal-process MCAVs; for the tested dataset and threshold, W1 above 4 and W2 above 8 gave the best result.The paper links higher weights to lower MCAVs and proposes shorter cell sampling time as one possible reason; confirmation with longer scans is future work.Source: §7 · p. 19

8. Conclusions and Future Work

The DCA combines immune-system inspiration with information-fusion principles, and its port-scan performance depends on careful signal selection. Its broader applicability remains untested, and its fused signal-plus-antigen data makes comparison with other techniques difficult.

8. Conclusions and Future Work

  • Careful signal selection matters: DCA is somewhat robust to misrepresented danger and PAMP signals, but an unsuitable safe signal can impede performance.Source: §8 · p. 19
  • Within a sensible parameter range, DCA detects ping-based port scans; anomalous-process detection is robust to signal-weight changes, while incorrect detections of normal processes vary widely.The reported sensitivity analysis finds the algorithm insensitive to parameter changes within a sensible range.Source: §8 · p. 19
  • For ping-scan detection, larger signal-processing weights are preferable, implying better performance when dendritic cells spend less time sampling signals.Source: §8 · p. 20
  • The fused signal-plus-antigen data makes DCA difficult to compare with standard machine-learning or signature-based IDS, while individual signals alone are insufficient for classification.Source: §8 · p. 20
  • Although general applicability remains unexplored, Kim et al applied the suggested signal mapping schema in sensor networks.Source: §8 · p. 20
  • Future work includes SYN-scan detection using multiple signals per category, potentially adaptive signals or weights, and applications to other detection or data-correlation problems.Proposed application areas include radio-signal analysis, sensor networks, and internet-worm detection.Source: §8 · p. 20

9. Acknowlegements

The acknowledgements name the project funder, image contributors, and graphic designer.

9. Acknowlegements

  • The project was supported by the EPSRC under grant GR/S47809/01.Source: §9 · p. 20
  • DC photographs were provided by Dr Julie McLeod and colleagues at UWE, UK.Source: §9 · p. 20
  • Mark Hammonds provided graphic design.Source: §9 · p. 20
Loading 1003.0789v1…